Any wordpress update or download ends with:"Update Failed: Download failed. cURL error 60: SSL certificate problem: unable to get local issuer certificate"

Symptoms

When trying to download or update plugins and themes through the WordPress admin panel, you get the following error:

Update Failed: Download failed. cURL error 60: SSL certificate problem: unable to get local issuer certificate

Description

WordPress uses an internally kept CA certificate, which can become outdated and prevent it from securely connecting to the update servers.

Workaround

Manually clear the CA certificate and download an updated one:

1. Access your server via SSH as the root user or as the cPanel user that holds the WordPress
2. Navigate to the WordPress installation's wp-includes folder and into the certificates subfolder. This will change depending on your $user and the installation path of your WordPress software, the below example would be the relative location for the primary domains Wordpress installation:

   /home/$user/public_html/wp-includes/certificates

3. Move the CA bundle out to a different file:

   mv ca-bundle.crt{,.$( date +%Y%m%d )} -v

4. In this same directory, download the latest CA bundle from WordPress:

   wget https://raw.githubusercontent.com/WordPress/WordPress/refs/heads/master/wp-includes/certificates/ca-bundle.crt

5. If file is downloaded while logged in as the root user, correct the permission of the downloaded file to match the cPanel user. The example below will work if $user is replaced with the cPanel username the website belongs to:

   chown -v $user: ca-bundle.crt

6. Log back in to the WordPress backend and retry the plugin and theme updates.